1 Topic by rohit.gavval

  • rohit.gavval
  • Member
  • Offline
  • Registered: 2021-03-31
  • Posts: 8

Topic: Add fail2ban jail for port 80

==== REQUIRED BASIC INFO OF YOUR IREDMAIL SERVER ====
- iRedMail version (check /etc/iredmail-release):  1.3.2 PGSQL edition
- Deployed with iRedMail Easy or the downloadable installer? downloadable installer
- Linux/BSD distribution name and version: RHEL 8.3
- Store mail accounts in which backend (LDAP/MySQL/PGSQL): PGSQL
- Web server (Apache or Nginx): Nginx
- Manage mail accounts with iRedAdmin-Pro? No
- [IMPORTANT] Related original log or error message is required if you're experiencing an issue.
====

I have an iRedMail installation on an AWS instance. Since I have to whitelist inbound traffic on port 80, I would like to add a fail2ban jail for this port. I checked the jail.local file under /etc/fail2ban but I don't see any jails configured in this file. Which file does iRedMail configure the jails in and how can I go about adding a new jail?

----

Spider Email Archiver: On-Premises, lightweight email archiving software developed by iRedMail team. Supports Amazon S3 compatible storage and custom branding.

2 Reply by ZhangHuangbin

  • ZhangHuangbin
  • ZhangHuangbin
  • iRedMail Developers
  • Offline
  • Registered: 2009-05-06
  • Posts: 31,088

Re: Add fail2ban jail for port 80

It's /etc/fail2ban/jail.d/. This is the standard directory used by Fail2ban.

3 Reply by rohit.gavval

  • rohit.gavval
  • Member
  • Offline
  • Registered: 2021-03-31
  • Posts: 8

Re: Add fail2ban jail for port 80

Thanks for your reply. Looking at the configuration it seems that the port 80 and 443 are already monitored for the nginx-http-auth jail
[nginx-http-auth]
backend     = polling
journalmatch=
enabled     = true
filter      = nginx-http-auth
logpath     = /var/log/nginx/error.log
action      = iptables-multiport[name=nginx, port="80,443,25,587,465,110,995,143,993,4190", protocol=tcp]
              banned_db[name=nginx, port="80,443,25,587,465,110,995,143,993,4190", protocol=tcp]

Hence I will not create another jail for http